PT-2024-7227 · Foxmarks · Foxmarks

Zefr0X · Published 2024-10-04 · Updated 2024-10-15 · CVE-2024-47884

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions foxmarks versions prior to 2.1.0

Description The issue is related to the creation of a temporary file in the /tmp directory with insecure permissions, allowing a malicious user to read confidential information from Firefox's database, including bookmarks, history, and input history. This occurs when the targeted user executes foxmarks bookmarks or foxmarks history commands.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory or monitoring the directory for insecure temporary files created by foxmarks.

Exploit

Fix

Weakness Enumeration

CWE-379

CWE-378

Related Identifiers

BDU:2024-08568

CVE-2024-47884

GHSA-8RH2-6PWM-5VVQ

Affected Products

Foxmarks

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47884.json · Exploit
• https://bdu.fstec.ru/vul/2024-08568 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47884 · Security Note
• https://github.com/zefr0x/foxmarks/security/advisories/GHSA-8rh2-6pwm-5vvq · Note
• https://github.com/zefr0x/foxmarks/commit/c3706bd882b3d61b353e4193f7d2dcfabd0c9a8e · Note
• https://vuldb.com/?id.280137 · Note
• https://t.me/cvedetector/7745 · Telegram Post